Privacy Policy

This Privacy Policy explains how TixCore ("we", "us"), operated by Yuvraj Sarda, handles information when you use our ticketing infrastructure as an Organizer or a Buyer.

1. Information we handle

From Organizers

• Account details: name, email, and authentication identity (via Supabase/Google).
• Organization details: name, branding, and event information you create.
• Payment gateway credentials, which are encrypted at rest (see below).

From Buyers

• Order details: name, email, and any custom fields the Organizer asks for (e.g. team, ticket type).
• Ticket records and check-in status.
• We do not store your card or payment details — those are handled entirely by the Organizer's payment gateway.

2. How payment credentials are protected

Organizer payment-gateway secrets are encrypted using AES-256-GCM before they are stored, and the decryption key is held separately from the database. Secrets are never returned to any browser and are used only server-side to create and verify orders.

3. How we use information

• To create accounts, events, orders, and tickets.
• To issue and deliver tickets (including by email, where enabled).
• To verify payments and prevent fraud and duplicate check-ins.
• To provide analytics to the Organizer for their own events.

We do not sell your personal data, and we do not show third-party advertising.

4. Who sees Buyer data

When you buy a ticket, your order information is shared with the Organizer of that event — they are the data controller for their attendees. TixCore processes this data on the Organizer's behalf to deliver the ticketing service. Each organization's data is isolated from every other organization's.

5. Service providers

We rely on a small number of infrastructure providers to operate:

• Supabase — database, authentication, and storage.
• Netlify — application hosting.
• Razorpay (or the Organizer's chosen gateway) — payment processing, controlled by the Organizer.
• An email delivery provider, where ticket emails are enabled.

6. Data retention

We retain event, order, and ticket data for as long as the Organizer's account is active, or as needed to provide the service and meet legal obligations. Organizers may request deletion of their organization's data.

7. Your choices

• Buyers may contact the relevant Organizer to access or delete their order data.
• Organizers may update or delete their account data through the dashboard or by request.

8. Security

We use encryption in transit (HTTPS), encryption at rest for sensitive secrets, tenant isolation, role-based access control, and signed tokens for tickets. No system is perfectly secure, but we apply industry-standard practices to protect your data.

9. Children

The Platform is not directed at children under 13, and we do not knowingly collect their personal data.

10. Changes

We may update this Policy. Material changes will be reflected by the "Last updated" date above.

11. Contact

For privacy questions, contact the Platform operator, Yuvraj Sarda, through the channel provided during onboarding.